According to a report at ars Technica, an ad on Google from a verified advertiser linked to a fake password manager site. The sneaky imposter site used punycode to generate unicode characters which represented ASCII characters looking like the official password manager site.

Google has, of course, removed the site once it was reported, but it ran from last Saturday until Wednesday.

[arstechnica.com...]